CVSS 3.1
8.6 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCVE-2026-45298
High (8.6) in amirraminfar dozzle. EPSS 1.5% chance of exploitation in the next 30 days.
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- amirraminfar:dozzle
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3v9w-6365-9w54 | Go | github.com/amir20/dozzle | <=8.14.12 | no fix published |
| GO-2026-5101 | Go | github.com/amir20/dozzle | all versions | no fix published |